LGDT

LGDT loads GDTR, the register that tells the processor where the global descriptor table lies: a linear base address and a 16-bit limit. Its memory operand is the pseudo-descriptor that SGDT stores, the limit in the first 2 bytes and the base after it, 8 bytes of it in 64-bit mode, so 10 in all. It is an operating system’s instruction, run during start-up, first in real mode to prepare the switch to protected mode and again once long mode is active, as Intel’s manual advises, to move to tables meant for 64-bit mode, which may lie above 4 GiB.

The table still matters in 64-bit mode#

Segmentation does little in 64-bit mode, but the GDT is still read: the CS descriptor’s L bit selects 64-bit or compatibility mode, a load of SS or a data segment register still reads its descriptor, and LTR finds the task state segment, which holds the stack pointers for interrupts, through a 16-byte descriptor there. The limit counts bytes and is inclusive, so a table of N 8-byte descriptors has the limit 8N - 1. Entry 0 is the null descriptor, which the processor never uses.

What it does not do#

LGDT changes GDTR and nothing else. Each segment register keeps the base, limit and attributes that it cached when its selector was loaded, so a new table takes effect only as the segment registers are reloaded: CS through a far jump or return, the others through MOV or POP. LGDT reads only its operand, not the table, so a bad descriptor shows up only when a selector is loaded.

Its operand and its checks#

In 64-bit mode the operand is always 10 bytes, whatever the prefixes. Outside it, the operand size decides: a 32-bit base, or with a 16-bit operand size, 24 bits, the top byte of GDTR then cleared. A non-canonical base raises #GP(0) in 64-bit mode, so GDTR never holds one. Both vendors list LGDT among the serializing instructions. Under Intel’s VMX, a hypervisor can make it exit with descriptor-table exiting.

LGDT runs only at CPL 0. The probe runs at CPL 3, and Zen 5 raised #GP in both recorded cases. AMD’s Zen 5 guide lists LGDT as microcoded and among the serializing instructions that close a write-combining buffer. LIDT is the same for the interrupt descriptor table, and LLDT loads a local one.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
v = src.read()                   # 10 bytes: the limit, then the base
if not canonical(v >> 16):
    fault(GP, 0)
gdtr = v                         # the limit in bits 15:0, the base in
                                 # bits 79:16, as SGDT stores them

if CPL > 0:
    fault(GP, 0)
v = src.read()                   # 6 bytes: the limit, then the base
b = v >> 16                      # 32 bits; with a 66 prefix the low
if OSIZE == 16:                  # 24, the top byte unused
    b &= 0xFFFFFF
gdtr = b << 16 | v & 0xFFFF

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDMSR
• RDPMC
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR